So I just downloaded a Network Sniffer on my local machine, as I think something is going on.

As soon as I opened it, selected my network adapter (an LTE stick), it started showing me requests from Chrome to s*.crdui.com (where * represents a 821 or 1821, for example: s1821.crdui.com).

Having looked around the web, it seems that it isn't dangerous, but nothing can tell me what it is.

This is the packet information for one of the many requests:

PacketData

EDIT

Just to clarify, if the subdomain is s1821, then the request path is always /related. If the subdomain is s821, then the request path is always /service2.

I'm running Windows 8.1.

EDIT 2

And I know that Chrome is doing it, because the sniffer tells me the User Agent String for the request - in my case, it is: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36

--

Does anyone have any idea what this is, and if it isn't such a good thing?

  • What OS is your computer running? – joeqwerty Jul 8 '14 at 15:17
  • You do know you can spoof the user agent right? – Ramhound Jul 8 '14 at 15:37
  • Do you have any 3rd party Extensions installed? Fire up an incognito window, close all others - and see if you have the same results. Also @Ramhound makes a good point. – SimonGates Jul 8 '14 at 15:37
  • True, but because it hasn't been identified as a virus, why would it spoof anything? @FooBar: Will give that a try. I have AdBlock Plus, Modern New Tab Page, Stylish, User-Agent Switcher for Chrome, and Web Developer installed. – Mike Rockétt Jul 8 '14 at 15:39
  • @FooBar: Must be an extension. Will fire through them all to see which one it is. Hopefully that will explain what the point of this domain is... – Mike Rockétt Jul 8 '14 at 15:41
up vote 1 down vote accepted

Do you have any 3rd party Browser Extensions installed?

Fire up an incognito window - this disables all extensions. Make sure to close all others and see if you have the same results.

On my system, I see the following:

POST /service2 HTTP/1.1 Host: s1821.crdui.com Connection: keep-alive Content-Length: 1632 Accept: application/json, text/javascript, /; q=0.01 Origin: chrome-extension://alelhddbbhepgpmgidjdcjakblofbmce User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 DNT: 1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8

Note that the origin is a chrome-extension. I looked up the extension ID and found that it's "Awesome Screenshot". If I disable that extension I no longer see requests to *.crdui.com. Apparently Diigo is tracking you if you use their program.

  • Indeed - I did already see that. Pity that extensions track you nowadays... – Mike Rockétt Jul 27 '14 at 5:36
  • Ugh. Just deleted this extension when I saw random error messages in my browser console. – Andrew Mao Aug 1 '14 at 19:17

It's one of the Chrome extensions. It's probably been sold to someone and they're tracking you.

From Warning: Your Browser Extensions Are Spying On You:

TL;DR version:

  • Browser add-ons for Chrome, Firefox, and probably other browsers are tracking every single page you visit and sending that data back to a third-party company that pays them for your information.
  • Some of these add-ons are also injecting ads into the pages that you visit, and Google specifically allows this for some reason as long as it is “clearly disclosed”.
  • Millions of people are being tracked this way and they don’t have a clue.

If you try to navigate to http://s1821.crdui.com/service2 it will redirect you to http://t1.webovernet.com/service2.

Note that.. "webovernet.com". Back to the linked article:

You can drop api28.webovernet.com and the other site into your browser to see where they lead, but we’ll save you the suspense: they are actually redirects for the API for a company called Similar Web, which is one of many companies doing this kind of tracking, and selling the data so other companies can spy on what their competitors are doing.

To stop it you'll either have to block the URL(s) it's trying to contact, or identify and uninstall the culprit extension.

  • Interesting - when I tried loading up one of the requests in the browser, I didn't get redirected... Thanks for bringing that up. :) I have now removed the extension. :) – Mike Rockétt Jul 8 '14 at 15:49

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.